topic Re: merge value from multiple fields into a single field. (Field = Value format) in Splunk Search

How to merge value from multiple fields into a single field (Field = Value format)?

tehong — Thu, 17 Feb 2022 00:37:40 GMT

Hi.

I want to merge data from multiple fields into a single field.

If you have a table like the following

fieldA, fieldB, fieldC
------------------------------
valueA, valueB, valueC

The expected output is as follows. I want to combine them into a single field in the Field = Value format.

merge_data = "fieldA = valueA, fieldB = valueB, fieldC = valueC"

I think it can be done using multivalue OR foreach, but I don't know how to code it.

Thanks in advance!!

ITWhisperer — Tue, 15 Feb 2022 08:00:09 GMT

| eval merge_data="," | foreach field* [| eval merge_data=merge_data."<<FIELD>>"."=\"".trim(<<FIELD>>)."\","] | eval merge_data=trim(merge_data,",")

tehong — Tue, 15 Feb 2022 09:00:19 GMT

Thanks perfect!!